IBM Files Patent to Trace Text Back to the AI Model That Wrote It
Most AI watermarks hide a secret pattern in the words a chatbot writes. IBM's filing leaves the model alone and checks whether a suspect text sits close, in meaning, to what the model was trained on.
What IBM's AI text fingerprint actually does
Every time a suspicious document turns up online, someone asks the same question: did our AI write this? For a company that keeps its AI model private, that is hard to answer, because the text carries no signature.
IBM's patent application describes a way to build a fingerprint from the material the model learned from. The system turns each training document into a list of numbers that captures its meaning, groups the documents that say similar things, and finds the middle of each group. Those middle points become the model's reference marks.
Later, you run a suspect document through the same process and measure how far it lands from those marks. If it is close enough, the system flags it as likely coming from that model. Nothing about the AI itself has to change.
… clustering the training embeddings to generate one or more reference centroids, wherein respective ones of the reference centroids represent clusters of semantically similar training embeddings …
Translation: Grouping the training data into thematic reference points to map out what the AI knows.
How IBM compares a document to training data
The claims cover a method in four stages. First, the company takes the documents it used to train a model and runs each through an embedding step (software that turns a piece of text into a long list of numbers reflecting its meaning). Second, it clusters those lists, grouping documents that mean similar things, and computes a centroid for each group (the average position of the cluster, like the center of a pile of pins on a map).
Third, the model goes live on a hosting server that answers requests. Fourth, when a candidate document shows up, it gets embedded the same way and its distance to the reference centroids is measured. The system then presents an indication that the document is attributable to the model, or, in one claim, that it is not.
The filing also describes several variations:
- One centroid for the whole training set, or several, such as one each for legal, medical and code-style text.
- A single suspect document, or a batch of documents that get their own combined centroid before the comparison.
- A tiered response based on how close the match is: logging it, notifying a company system, invalidating access credentials, or moving the model into a locked-down hosting environment.
The centroids are stored in a separate secure system, away from the servers that run the model.
… comparing the one or more candidate embeddings to the one or more reference centroids using a vector space distance metric …
Translation: Measuring how close a suspect text is to those reference points to spot AI authorship.
Why this matters for companies guarding AI models
If you run a private AI model, the nagging worry is that someone is using it without permission, or that its output is turning up where it shouldn't. This approach would give the owner a way to check suspect text after the fact, without rebuilding the model or changing how it writes. The description names risks such as disinformation, students passing off AI work, and unapproved models being used inside a company.
The filing frames the tool for enterprises. It ties each level of similarity to a response, from a quiet log entry for weak matches to a full lockdown for the closest ones. It is a patent application, so it says nothing about a product or a release, but it shows how IBM thinks about tracing AI output without touching the model.
That makes this IBM's 69th filing we've tracked since May in our AI safety guardrails watchlist, adding to work like picking the best AI model and AI designing secure systems.
The big win is that the AI itself never changes, so its quality stays intact and nothing has to be retrofitted. The price is that the fingerprint measures subject matter and writing style, the general territory a text lives in. A legal memo written by a person, or by a rival model, could land just as close to a legal-heavy centroid as one from IBM's own model.
The owner also needs the original training data, and the same embedding tool must run on both sides. That suits a company guarding its own model and leaves outsiders with no way to run the check.
The tiered responses add a second risk: a similarity score alone can cancel credentials or lock a model down, so a false match could hit real users. The description says the thresholds can be tuned, and that dial carries a lot of weight. For flagging suspicious text the trade looks fair, and for shutting things down it looks thin.
Get our take in your Top Stories
Liked this breakdown? Add Patentlyze as a preferred source on Google, and our plain-English take shows up more often in your Top Stories the next time IBM patent news breaks.
There are more where this came from
We read every patent application Big Tech publishes and send you the ones worth knowing. Plain English, free, every week.
The drawings
8 drawing sheets from US 2026/0340493 A1 · click any drawing to enlarge
Want this weekly breakdown for a company we don't cover? Patentlyze Pro →
Be the first to weigh in